Hugging Face Kernels brings native code to the Hub — will code signing stop supply chain attacks

hugging face released a major update for its kernels project, introducing a new 'kernel' repository type that makes custom compute kernels first-class citizens on the hub. the update enables users to filter kernels by supported accelerators, operating systems, and backend versions, addressing the need for standardized packaging of high-performance ai code. recognizing that kernels run native code with significant privileges, hugging face implemented a robust security framework requiring reproducible builds via nix, trusted publishers, and mandatory code signing using sigstore’s cosign to prevent supply chain compromises. the platform restricts kernel publishing permissions by default and requires users to explicitly opt-in via trust_remote_code to load kernels from unverified sources. these changes establish a more secure and discoverable ecosystem for distributing critical ai infrastructure components.